-
Notifications
You must be signed in to change notification settings - Fork 26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Signer authorized keys #610
Merged
Merged
Commits on Oct 24, 2023
-
Support for Signer Authorized Keys
Authorized key is the tezos native method to authenticate signing requests, one that we use in the new tezos-kms-signer-lambda. This adds the required support on tezos-k8s to sign with such a signer. The way it works in octez is: * when the baker/client connects to the signer for the first time, signer answers with a list of "authorized_keys" that the signature request must be signed with. These authorized keys are just tezos accounts * if the baker/client has the secret key for one of these authorized keys, they will just sign every request with it. otherwise, there will be an error * this can't be nested. the authorized_key can't be remote We add support in tezos-k8s by assuming the authorized_keys are just standard "accounts". Then, you may configure a baker as follows: ``` nodes: mybaker: bake_using_accounts: - mybakeraddy authorized_keys: - my_authorized_key ``` config-generator then ensures that the private authorized key is accessible to the baker. We also add support on octez-signer end: ``` octezSigners: mysigner: sign_for_accounts: - mybakeraddy authorized_keys: - my_authorized_key ``` When set, the signer mandates requests to be authenticated. Otherwise, it signs anything. This way, you can test end-to-end in a private chain. We modify mkchain to do this by default: mkchain now generates an authorized key and uses it to sign by default. Also, mkchain was previously defaulting to using one remote signer, but this broke when adding support for tacoInfra signer. I fixed it. I have tested it with 3 bakers and 2 signers, one authorized and one not. It's all working. I haven't tried zerotier and public chains. Other changes: * switch default version to 17.3 * no magic byte restriction from signer - prevents activation
Configuration menu - View commit details
-
Copy full SHA for 5afa03f - Browse repository at this point
Copy the full SHA 5afa03fView commit details
Commits on Oct 25, 2023
-
Update mkchain/tqchain/mkchain.py
Co-authored-by: Aryeh Harris <harryttd@users.noreply.github.com>
Configuration menu - View commit details
-
Copy full SHA for 804b2c8 - Browse repository at this point
Copy the full SHA 804b2c8View commit details -
Update charts/tezos/values.yaml
Co-authored-by: Aryeh Harris <harryttd@users.noreply.github.com>
Configuration menu - View commit details
-
Copy full SHA for aa9233a - Browse repository at this point
Copy the full SHA aa9233aView commit details -
Configuration menu - View commit details
-
Copy full SHA for e1c5304 - Browse repository at this point
Copy the full SHA e1c5304View commit details
Commits on Nov 6, 2023
-
Configuration menu - View commit details
-
Copy full SHA for 2ec0c45 - Browse repository at this point
Copy the full SHA 2ec0c45View commit details -
Configuration menu - View commit details
-
Copy full SHA for fd58c59 - Browse repository at this point
Copy the full SHA fd58c59View commit details -
Update charts/tezos/templates/_helpers.tpl
Co-authored-by: Aryeh Harris <harryttd@users.noreply.github.com>
Configuration menu - View commit details
-
Copy full SHA for be05447 - Browse repository at this point
Copy the full SHA be05447View commit details
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.